The Data Link Layer (Layer 2) provides node-to-node communication within a local network. Two key concepts: the MAC address (who the device is) and ARP (how to find a device’s MAC given its IP).
MAC Address (Media Access Control)
A 48-bit hardware address, typically written as 6 pairs of hex digits: 00:0C:29:44:D4:C1.
| Property | Description |
|---|---|
| Length | 48 bits (6 bytes) |
| Format | 6 hex pairs, e.g., AA:BB:CC:DD:EE:FF |
| Scope | Local network only (not routable on internet) |
| Assignment | Burned into NIC by manufacturer (OUI prefix) |
| Layer | Layer 2 (Data Link) |
The first 24 bits are the OUI (Organizationally Unique Identifier) assigned to the manufacturer (e.g., Cisco, Intel). The remaining 24 bits are the device-specific serial.
MAC vs IP Address
| MAC Address | IP Address | |
|---|---|---|
| Layer | Layer 2 | Layer 3 |
| Scope | Local network | Global (routable) |
| Persistence | Permanent (usually) | Can change (DHCP) |
| Analogy | Your name | Your mailing address |
ARP (Address Resolution Protocol)
ARP maps IP addresses to MAC addresses within a local network.
- Host A needs to send data to IP 192.168.1.5
- Host A checks its ARP cache (local table of IP→MAC mappings)
- If not found, Host A broadcasts an ARP Request: “Who has 192.168.1.5?”
- Host B with that IP responds with its MAC address (unicast ARP Reply)
- Both hosts update their ARP caches
ARP cache entries expire after a few minutes to handle IP changes.
Q: What is the difference between MAC and IP addresses?
A: A MAC address is a permanent hardware identifier tied to the NIC (Layer 2). An IP address is a logical, network-assigned address that identifies the device’s location (Layer 3). MAC = identity, IP = location.
Q: How does ARP work?
A: When a device knows the destination IP but not the MAC, it broadcasts an ARP Request on the local network. The device with the matching IP responds with its MAC address via unicast. Both sides cache the mapping.
Q: Can a MAC address be changed?
A: Physically it’s burned into the NIC (permanent), but software can spoof/override it at the OS level for privacy or compatibility reasons. This is called MAC spoofing.
Q: What is an ARP cache?
A: A local table mapping IP addresses to MAC addresses. Entries are added dynamically via ARP and have a timeout (usually 2-5 minutes). This avoids broadcasting ARP for every packet.
Premium Content
Unlock MAC Address & ARP and all premium lessons with a subscription.
From ₹199.99/year — See plans